Typically the purpose of a front-end for an Ethereum DApp is to provide a 'pretty' method of calling functions that are on the uploaded smart contract. Of Course, the hacker could change the address of the smart contract that the user interacts with (but the user is always able to see where their transactions are going). You can host a decentralized front-end with IPFS https://ipfs.io
The great thing about using a decentralized backend and using tools like EtherScan is that we are always able to see where our Ether is going and to who with relative simplicity.
If the frontend did happen to be high jacked and the hacker did change the contract address, the user would be able to see that their transactions are not going to the address that it should be (think of it as you know your friends street address, someone has stolen their phone and messages you to come to a different address with the intention of robbing you, you'll be wary of going to that address as you've never gone there before and there's no reason given as to why). You'd also be able to view the number of transactions that the contract has had on it (only useful if it's recently been high jacked). I think this is a somewhat minor issue and can be solved by using IPFS (It can be slow however).
To give an overview of what the hacker would have to do to get Ether maliciously from users, they would have too;
- Create and publish a new smart contract that funneled funds to their personal wallet
- Create a payable function in that smart contract
- Link that payable function to the front-end. The function would also have to have a similar gas price as not to arouse suspicions from users
- Change the ABI reference in the front-end
- Hope no one noticed!